secure sentora with https? - Printable Version

secure sentora with https? - Printable Version

+- Sentora Support Forums (https://senforums.mach-hosting.com)
+-- Forum: Sentora Forum Archives (https://senforums.mach-hosting.com/forumdisplay.php?fid=5)
+--- Forum: Sentora Public Support Forums v1.0.x (https://senforums.mach-hosting.com/forumdisplay.php?fid=32)
+---- Forum: General Support Forum v1.0.x (https://senforums.mach-hosting.com/forumdisplay.php?fid=36)
+---- Thread: secure sentora with https? (/showthread.php?tid=1034)

Pages: 1 2

secure sentora with https? - SupaYoshi - 02-12-2015

Hi I want to secure the default sentora url with SSL. I have a vhost entry using SSL now, but I want the main panel secured with SSL.

Which config do I edit for that? And where do I put my SSL information in for the panel?
Let me know please

RE: secure sentora with https? - Me.B - 02-12-2015

You should do this manually and add it in apache config file.

M B

RE: secure sentora with https? - SupaYoshi - 02-12-2015

(02-12-2015, 05:09 AM)Me.B Wrote: You should do this manually and add it in apache config file.

M B

So i should add it into /etc/sentora/configs/apache/httpd-vhosts.conf?

RE: secure sentora with https? - Me.B - 02-12-2015

better you do all the config in another file and include it in apache main config. Don't touche sentora originally configured files.

RE: secure sentora with https? - SupaYoshi - 02-12-2015

(02-12-2015, 05:21 AM)Me.B Wrote: better you do all the config in another file and include it in apache main config. Don't touche sentora originally configured files.

I really don't understand why it has to be so hard to enable SSL for the control panel.. I have to create a default config file? Can't I just set the SSL certificate in the Global Sentora Entry? And change the port to 443?

Because when I do put it in there, it works but I get SSL on port 80... any idea?

RE: secure sentora with https? - SupaYoshi - 02-12-2015

Me.B. Please let me know how I can enable SSL for my domains, without having them force SSL (redirect port 80 to 443)

And I want to enable SSL for my sentora URL too. Where do I do this, I read the wiki pages but they are not very helpful since they make you end up with ssl working on port 80..

RE: secure sentora with https? - Me.B - 02-12-2015

Requirement here.

Having your SSL certificate issued & ok.

Basic knowledge over apache admin & conf files.

1. create a new file for panel SSL Setup:
/etc/sentora/configs/http-panel-ssl.conf

Code:
Listen 443
# Configuration for Sentora control panel with SSL.
<VirtualHost *:443>
ServerAdmin zadmin@localhost
DocumentRoot "/etc/sentora/panel/"
ServerName panel.FQDNN
ErrorLog "/var/sentora/logs/sentora-error.log"
CustomLog "/var/sentora/logs/sentora-access.log" combined
CustomLog "/var/sentora/logs/sentora-bandwidth.log" common
AddType application/x-httpd-php .php
<Directory "/etc/sentora/panel/">
Options +FollowSymLinks -Indexes
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>
SSLEngine on
   SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
   SSLCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM;^M    SSLHonorCipherOrder on
   SSLCertificateFile /etc/sentora/configs/ssl/sentora.crt
   SSLCertificateKeyFile /etc/sentora/configs/ssl/sentora.pem
   SSLCertificateChainFile /etc/sentora/configs/ssl/sentora.crt
</VirtualHost>

you need to replace : ServerName panel.FQDNN with your panel sub domain you had setup.

You will notice we need 3 files here for your SSL ( you can change the path if you want):

SSLCertificateFile /etc/sentora/configs/ssl/sentora.crt
SSLCertificateKeyFile /etc/sentora/configs/ssl/sentora.pem
SSLCertificateChainFile /etc/sentora/configs/ssl/sentora.crt

Once this config file setup.

You can include it in the main apache conf file would be last one after all previous sentora include files.

Once you do the setup and add this file your panel can be accessed using 80 & port 443 under HTTPS on the same time. Up to you then using a .htaccess to enforce https or leave it.

Would this be ok & clear?

M B

RE: secure sentora with https? - SupaYoshi - 02-12-2015

(02-12-2015, 07:50 AM)Me.B Wrote: Requirement here.

Having your SSL certificate issued & ok.

Basic knowledge over apache admin & conf files.

1. create a new file for panel SSL Setup:
/etc/sentora/configs/http-panel-ssl.conf

Code:
Listen 443 # Configuration for Sentora control panel with SSL. <VirtualHost *:443> ServerAdmin zadmin@localhost DocumentRoot "/etc/sentora/panel/" ServerName panel.FQDNN ErrorLog "/var/sentora/logs/sentora-error.log" CustomLog "/var/sentora/logs/sentora-access.log" combined CustomLog "/var/sentora/logs/sentora-bandwidth.log" common AddType application/x-httpd-php .php <Directory "/etc/sentora/panel/"> Options +FollowSymLinks -Indexes AllowOverride All Order allow,deny Allow from all </Directory> SSLEngine on SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2 SSLCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM;^M SSLHonorCipherOrder on SSLCertificateFile /etc/sentora/configs/ssl/sentora.crt SSLCertificateKeyFile /etc/sentora/configs/ssl/sentora.pem SSLCertificateChainFile /etc/sentora/configs/ssl/sentora.crt </VirtualHost>

you need to replace : ServerName panel.FQDNN with your panel sub domain you had setup.

You will notice we need 3 files here for your SSL ( you can change the path if you want):

SSLCertificateFile /etc/sentora/configs/ssl/sentora.crt
SSLCertificateKeyFile /etc/sentora/configs/ssl/sentora.pem
SSLCertificateChainFile /etc/sentora/configs/ssl/sentora.crt

Once this config file setup.

You can include it in the main apache conf file would be last one after all previous sentora include files.

Once you do the setup and add this file your panel can be accessed using 80 & port 443 under HTTPS on the same time. Up to you then using a .htaccess to enforce https or leave it.

Would this be ok & clear?

M B

I've done everything as you said, works good but now I get 503, Forbidden error when I go to the https website.

EDIT: After i removed the Order allow,deny
from the config you gave me it works,

My config now looks like this exactly the same as the config does for the normal sentura panel.

Few changes I made,
- Why do you include a file that is in the root directory /etc/sentura/configs/ why not put it next to the other ones? /etc/sentura/configs/apache/ ? I made it include this way.

Code:
# Include SSL thingy for panel
Include /etc/sentora/configs/apache/http-panel-ssl.conf

- I do the SSL protocol a little different, I do this,

Code:
SSLProtocol all -SSLv2 -SSLv3
        SSLHonorCipherOrder on
        SSLCipherSuite "CDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5"

This because SSLv2 and SSLv3 are vulnerable to poodle attacks please edit that.

Code:
Listen 443
# Configuration for Sentora control panel with SSL.
<VirtualHost *:443>
ServerAdmin zadmin@localhost
DocumentRoot "/etc/sentora/panel/"
ServerName domain.something.something
ErrorLog "/var/sentora/logs/sentora-error.log"
CustomLog "/var/sentora/logs/sentora-access.log" combined
CustomLog "/var/sentora/logs/sentora-bandwidth.log" common
AddType application/x-httpd-php .php
<Directory "/etc/sentora/panel/">
Options +FollowSymLinks -Indexes
   AllowOverride All
#   Order allow,deny
   Require all granted
</Directory>
SSLEngine on
#  SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2
#  SSLCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM;^M    SSLHonorCipherOrder on
  SSLCertificateFile /etc/apache2/ssl/cert.crt
  SSLCertificateKeyFile /etc/apache2/ssl/cert.key
  SSLCACertificateFile /etc/apache2/ssl/rootca.crt

</VirtualHost>

RE: secure sentora with https? - SupaYoshi - 02-12-2015

Okay now this works, I want to enable the same thing for my domain i have in my sentora httpd-vhosts.conf. (i do this with the panel as required)

Just a suggestion would be to do this on default, it is very weird to have non-ssl websites nowdays, especially since google is going to rank websites higher using ssl sooner or later. (rumor) and that this is very hard to setup for each domain that you add and in case you have customers or use this packet for resellers you can't expect them to go through all this trouble.

Why doesn't sentora open up port 443 by default? Smile

with self signed certificates at least.

Anyway, to continue. I have a domain added to sentura.

I go to Control Panel, Module admin, Apache Config, and I go to ovverride a Virtual Host setting.

I select the domain I want to overwrite, and I want both port 80 and 443 to work with that domain...
The tutorial on this forum expects all traffic to be enabled over SSL. I don't want that, I only want certain urls to be SSL... so I am trying to do a custom entry without changing the normal virtual host one.. is that even possible?
So not a override but an addition for ssl?

RE: secure sentora with https? - Me.B - 02-12-2015

Ok great ot hear that.

Notice default SSL would require that you have SSL certificates ready and built. Would not be cool to setup SSL with own made SSL as you can see in chrome it will trigger errors and don't think google will rank higher such websites. We will work on improving SSL for sure and trying to find the right balance.

MB